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DESCRIPTION 

QUANTUM KEY DISTRIBUTION METHOD AND COMMUNICATION APPARATUS 

5 TECHNICAL FIELD 

The present invention relates to a quantum key- 
distribution method capable of generating a common key, 
security of which is highly guaranteed, and more 
particularly, to a quantum key distribution method capable 
10 of correcting a data error using an error correction code 
and a communication apparatus capable of realizing the 
quantum key distribution. 

BACKGROUND ART 

15 The conventional quantum cryptograph system is 

explained below. In recent years, optical communication is 
widely used as a high-speed large-capacity communication 
technology. In such an optical communication system, 
communication is performed according to ON/OFF of light and 

20 a large quantity of photons are transmitted when light is 
ON. Thus, the optical communication system is not a - 
communication system in which a quantum effect is developed 
directly . 

On the other hand, in the quantum cryptograph system, 
25 photons are used as communication media to transmit 

information of one bit using one photon such that a quantum 
effect such as uncertainty principle is developed. In this 
case, when a wiretapper selects a base at random and 
measures photons without knowing a quantum state such as 
30 polarization and a phase of the photons, the quantum state 
changes. Therefore, on the reception side, it is possible 
to recognize, by confirming the change in the quantum state 
of the photons, whether transmitted data has been 
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wiretapped . 

Fig. 19 is a schematic of the conventional quantum key 
distribution using polarized light. For example, a 
measuring device, which is capable of identifying polarized 
5 light in horizontal and vertical directions, identifies 

light polarized in the horizontal direction (0°) and light 

polarized in the vertical direction (90°) on a quantum 
communication path correctly. On the other hand, a 
measuring device, which is capable of identifying polarized 

10 light in oblique directions (45° and 135°) , identifies 

light polarized in the 45° direction and 135° direction on 
a quantum communication path correctly. 

In this way, the respective measuring devices can 
recognize light polarized in the defined directions 
15 correctly. However, for example, when the measuring device, 
which is capable of identifying polarized light in the 

horizontal and vertical directions (0° and 90°) , measures 
light polarized in an oblique direction, the measuring 
device identifies light polarized in the horizontal 

20 direction and light polarized in the vertical direction at 
random at a probability of 50 percent, respectively. In 
other words, when the measuring device that does not cope 
with identifiable polarization directions is used, it is 
impossible to identify a direction in which light is 

25 polarized even if a result of measurement by the measuring 
device is analyzed. 

In the conventional quantum key distribution shown in 
Fig. 19, a sender and a receiver share a key while keeping 
the key secret from wiretappers (see, for example, 

30 Nonpatent Literature 1) . Note that the sender and the 

receiver can use a public communication path other than the 
quantum communication path. 
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A procedure for sharing a key is explained. First, 
the sender generates a random number sequence (a sequence 
of 1 and 0 : transmission data) and determines transmission 
codes (+: a code corresponding to the measuring device 
5 capable of identifying light polarized in the horizontal 

and vertical directions, x: a code corresponding to the 
measuring, device capable of identifying light polarized in 
the oblique directions) at random. A polarization 
direction of light to be transmitted is automatically 
10 determined according to combinations of the random number 
sequence and the transmission codes. Light polarized in 
the horizontal direction according to a combination of 0 
and +, light polarized in the vertical direction according 

to a combination of 1 and +, light polarized in the 45° 

15 direction according to a combination of 0 and x, and light 

polarized in the 135° direction according to a combination 

of 1 and x are transmitted to the quantum communication 
path, respectively (transmission signals). 

The receiver determines reception codes (+: a code 
20 corresponding to the measuring device capable of 

identifying light polarized in the horizontal and vertical 

directions, x: a code corresponding to the measuring device 
capable of identifying light polarized in the oblique 
directions) at random and measures light on the quantum 

25 communication path (reception signals) . The receiver 

obtains reception data according to combinations of the 
reception codes and the reception signals. The receiver 
obtains 0, 1, 0, and 1 as reception data according to a 
combination of the light polarized in the horizontal 

30 direction and + , a combination of the light polarized in 
the vertical direction and + , a combination of the light 

polarized in the 45° direction and x, and a combination of 
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the light polarized in the 135° direction and x, 
respectively . 

In order to check whether measurement for the receiver 
has been performed by a correct measuring device, the 
5 receiver sends the reception codes to the sender thorough 
the public communication path. The sender, who has 
received the reception codes, checks whether the 
measurement has been performed by a correct measuring 
device and returns a result of the check to the receiver 

10 through the public communication path. 

The receiver keeps only the reception data 
corresponding to the reception signals received by the 
correct measuring device and disposes of other reception 
data. At this point, the reception data kept can be shared 

15 by the sender and the receiver surely. 

The sender and the receiver send a predetermined 
number of data selected from the shared data to each other 
through the public communication path. Then, the sender 
and the receiver check whether the reception data coincide 

20 with the data held by the sender and the receiver 

themselves. For example, if at least one data among the 
data checked does not coincide with the data held by the 
sender and the receiver, the sender and the receiver judge 
that a wiretapper is present, dispose of the shared data, 

25 and repeat the procedure for sharing a key from the 

beginning. On the other hand, when all the data checked 
coincide with the data held by the sender and the receiver, 
the sender and the receiver judge that no wiretapper is 
present, dispose of the data used for the check, and use 

30 the remaining shared data as a shared key for the sender 
and the receiver. 

On the other hand, as an application of the 
conventional quantum key distribution method, for example, 
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there is a quantum key distribution method that is capable 
of correcting a data error on a transmission path (see, for 
example, Nonpatent Literature 2) . 

In this method , to detect a data error , a sender 
5 divides transmission data into plural blocks and sends a 

parity for each block on a public communication path. Then, 
a receiver compares the parity for each block received 
through the public communication path and a parity of a 
corresponding block in reception data to check a data error. 

10 In this case, when there is a different parity, the 

receiver returns information indicating a block of the 
different parity on the public communication path. The 
sender further divides the pertinent block into a former 
half block and a latter half block and returns, for example, 

15 a former half parity on the public communication path 

(binary search). Thereafter, the sender and the receiver 
specify a position of an error bit by repeatedly executing 
the binary search. Finally, the receiver corrects the bit. 
Moreover, assuming that a parity is judged as correct 

20 because of an even number of errors regardless of an error 
in data, the sender rearranges transmission data at random 
(random replacement) to divide the transmission data into 
plural blocks and performs the error correction processing 
with the binary search again. Then, the sender repeatedly 

25 executes this error correction processing with the random 
replacement to thereby correct all the data errors. 
Nonpatent Literature 1 

Bennett, C. H. and Brassard, G., "Quantum 
Cryptography" , Public Key Distribution and Coin Tossing, In 
30 Proceedings of IEEE Conference on Computers, System and 
Signal Processing, Bangalore, India, pp. 175-179 (DEC. 
1984) . 

Nonpatent Literature 2 



Brassard, G. and Salvail, L., "Secret-Key 
Reconciliation by Public Discussion" , In Advances in 
Cryptology-EUROCRYPT ' 93, Lecture Notes in Computer Science 
765, pp. 410-423 (1993) . 

However, an error communication path is not assumed in 
the conventional quantum key distribution shown in Fig. 19. 
Therefore, when there is an error, the sender and the 
receiver dispose of the common data (the common key) 
judging that a wiretapping act is performed. This 
extremely deteriorates efficiency of generation of a common 
key depending on a transmission path. 

In the quantum key distribution method capable of 
correcting a data error on the transmission path, parities 
are exchanged an extremely large number of times to specify 
an error bit and the error correction processing by the 
random replacement is performed for a predetermined number 
of times. Therefore, a great deal of time is consumed for 
the error correction processing. 

The present invention has been devised in view of the 
circumstances and it is an object of the present invention 
to provide a quantum key distribution method that is 
capable of generating a common key, security of which is 
highly guaranteed, while correcting a data error on a 
transmission path using an error correcting code having an 
extremely high property. 

DISCLOSURE OF INVENTION 

A quantum key distributing method according to one 
aspect of the present invention is for correcting an error 
of reception data with probability information obtained as 
a result of measurement of photons on a quantum 
communication path to estimate original transmission data 
and using a result of the estimation as shared information. 



The quantum key distributing method includes a first check- 
matrix generating step at which communication apparatus on 
a transmission side and a reception side individually 
generate a first parity check matrix (identical in the 
respective devices) optimized at a coding ratio in a 
desired range and extract a second parity check matrix 
(identical in the respective devices) corresponding to a 
specific coding ratio in the range from the first parity 
check matrix; a first error-correction-information 
notifying step at which the communication apparatus on the 
transmission side notifies the communication apparatus on 
the reception side of first error correction information 
generated based on the second parity check matrix and the 
transmission data via a public communication path; a first 
error correction step at which the communication apparatus 
on the reception side corrects an error of the reception 
data based on the first error correction information; a 
second check-matrix generating step at which, when the 
error of the reception data is not completely corrected, 
the communication apparatuses on the reception side and the 
transmission side individually extract a third parity check 
matrix (identical in the respective devices) corresponding 
to a coding ratio lower than the last coding ratio from the 
first parity check matrix such that the last error 
correction information is a part of information at the time 
of next error correction; a second error-correction- 
information notifying step at which the communication 
apparatus on the transmission side notifies the 
communication apparatus on the reception side of additional 
second error correction information generated based on the 
third parity check matrix and the transmission data via the 
public communication path; a second error correction step 
at which the communication apparatus on the reception side 
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corrects the error of the reception data based on the first 
and the second error correction information; and an 
encryption-key generating step of discarding a part of 
shared information according to an amount of error 
5 correction information laid open to the public and setting 
a result of discarding the part of the shared information 
as an encryption key when the error of the reception data 
is completely corrected in the processing at the first 
error correction step or when the error is completely 

10 corrected by repeatedly executing the processing at the 
second check-matrix generating step, the second error- 
correction-information notifying step, and the second error 
correction step. 

According to the present invention, an error of 

15 reception data is corrected using check matrixes for the 
w Irregular-LDPC code", which are definite and have stable 
characteristics, and a part of shared information is 
discarded according to error correction information laid 
open to the public. Consequently, parities are not 

20 exchanged the enormous number of times to specify and 
correct an error bit. Error correction control is 
performed by simply transmitting error correction 
information. Thus, it is possible to substantially reduce 
time required for error correction processing. Since a 

25 part of shared information is discarded according to 

information laid open to the public, it is possible to 
generate a common key security of which is highly 
guaranteed . 

Furthermore, according to the present invention, a 
30 parity check matrix corresponding to a specific coding 

ratio is extracted from parity check matrixes optimized by 
coding ratios in a predetermined range while the coding 
ratio is lowered until an error of reception data is 



completely corrected, an additional syndrome is generated, 
and error correction processing is repeatedly executed 
using the additional syndrome. Since this makes it 
unnecessary to discard shared information generated for 
estimating a noise level of a communication path, it is 
possible to substantially improve efficiency of generating 
a common key. 

BRIEF DESCRIPTION OF DRAWINGS 

Fig. 1 is a diagram of a constitution of a quantum 
cryptographic system according to the present invention; 

Fig. 2 is a flowchart of quantum key distribution 
according to a first embodiment of the present invention; 

Fig. 3 is a flowchart of quantum key distribution 
according to the first embodiment; 

Fig. 4 is a diagram of a structure of a parity check 
matrix H R( i) ; 

Fig. 5 is a flowchart of a method of forming an 
"Irregular-LDPC code'' based on a Euclidian geometric code; 

Fig. 6 is a diagram of a matrix of a Euclidian 
geometric code EG (2, 2 2 ) ; 

Fig. 7 is a diagram of a matrix after permutation; 

Fig. 8 is a table of an order allocation after 
optimization calculation; 

Fig. 9 is a table of an order allocation after 
adj ustment ; 

Fig. 10 is a diagram of a parity check matrix H R ( 3) ; 

Fig. 11 is a table of an order allocation obtained as 
a result of the optimization calculation; 

Fig. 12 is a diagram of an additional matrix A R(2 ) ; 

Fig. 13 is a diagram of a parity check matrix H R(2 ) ; 

Fig. 14 is a diagram of a specific example of an 
additional matrix A r( d ; 
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Fig. 15 is a diagram of a specific example of the 
parity check matrix H r( d ; 

Fig. 16 is a diagram of a syndrome S A that a 
communication apparatus on a transmission side transmits to 
a communication apparatus on a reception side; 

Fig. 17 is a diagram for explaining how a parity check 
matrix H R(L _i) is extracted from the parity check matrix 

r 

Hr(d ; 

Fig. 18 is a diagram of a method of generating an 
additional syndrome; and 

Fig. 19 is a diagram of conventional quantum key 
distribution that uses polarization. 

BEST MODE(S) FOR CARRYING OUT THE INVENTION 
15 Exemplary embodiments of a quantum key distribution 

method according to the present invention are explained in 
detail below with reference to the accompanying drawings . 
Note that the present invention is not limited by the 
embodiments. Quantum key distribution using polarized 
20 light is explained below as an example. However, the 
present invention is also applicable to , for example, 
quantum key distribution using a phase, quantum key 
distribution using a frequency, and the like. There is no 
specific limitation on what kind of quantum state is used. 
25 Quantum key distribution is a key distribution system, 

security of which is guaranteed regardless of a computing 
ability of a wiretapper. For example, to generate a shared 
key efficiently, it is necessary to remove an error of data 
that is caused when the data is transmitted through a 
30 transmission path. Thus, according to the present 

embodiment, quantum key distribution for performing error 
correction using a Low-Density Parity-Check (LDPC) code, 
which is known as having an extremely high property , is 
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explained. 

Fig. 1 is a block diagram of a structure of a quantum 
cryptograph system (communication apparatuses on a 
transmission side and a reception side) according to the 
5 present invention. This quantum cryptograph system 

includes the communication apparatus on the transmission 
side, which has a function of transmitting information m a , 
and the communication apparatus on the reception side, 
which has a function of receiving the information m a 

10 affected by noise and the like on a transmission path, that 
is, information m b . 

The communication apparatus on the transmission side 
includes an encryption-key generating unit 1 , which 
transmits the information m a through a quantum 

15 communication path, transmits a syndrome S A thorough a 

public communication path, and generates an encryption key 
(a common key common to the transmission side and the 
reception side) based on the transmitted information, and a 
communication unit 2 in which a transmission/reception unit • 

20 22 transmits and receives data, which is encrypted by an 

encryption unit 21 based on the encryption key, through the 
public communication path. The communication apparatus on 
the reception side includes an encryption-key generating 
unit 3, which receives the information m b through the 

25 quantum communication path, receives the syndrome S A 

through the public communication path, and generates an 
encryption key (a common key common to the reception side 
and the transmission side) based on information on the 
received information, and a communication unit 4 in which a 

30 transmission/reception unit 41 transmits and receives data, 
which is encrypted by an encryption unit 42 based on the 
encryption key, through the public communication path. 

The communication apparatus on the transmission side 
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transmits light polarized in a predetermined direction 
using a polarization filter to the communication apparatus 
on the reception side as the information m a to be 
transmitted on the quantum communication path. On the 
5 other hand, the communication apparatus on the reception 

side identifies light polarized in the horizontal direction 

(0°) , light polarized in the vertical direction (90°) , 

light polarized in the 45° direction, and light polarized 

r 

in the 135° direction on the quantum communication path 
10 using a measuring device capable of identifying polarized 

light in the horizontal and vertical directions (0° and 

90°) and a measuring device capable of identifying 

polarized light in the oblique directions (45° and 135°) . 
Not that the respective measuring devices can recognize 
15 light polarized in the defined directions correctly. 

However, for example, when the measuring device, which is 
capable of identifying polarized light in the horizontal 

and vertical directions (0° and 90°) , measures light 
polarized in an oblique direction, the measuring device 

20 identifies . light polarized in the horizontal direction and 
light polarized in the vertical direction at random at a 
probability of 50 percent, respectively. In other words, 
when the measuring device that does not cope with 
identifiable polarization directions is used, it is 

25 impossible to identify a direction in which light is 

polarized even if a result of measurement by the measuring 
device is analyzed. 

Operations of the respective communication apparatuses 

* 

in the quantum cryptograph system, that is, quantum key 
30 distribution according to the present embodiment is 

explained in detail below. Fig. 2 and 3 are flowcharts of 
an outline of the quantum key distribution according to the 



present embodiment. Specif ically , Fig. 2 is a flowchart of 
processing in the communication apparatus on the 
transmission side and Fig. 3 is a flowchart of processing 
in the communication apparatus on the reception side. 

First, in the communication apparatus on the 
transmission side and the communication apparatus on the 
reception side, parity-check-matrix generating units 10 and 
30 calculate a parity check matrix H of a specific liner 
code. A coding ratio is * 0<R ( 1 ) <R ( 2 ) < . . . <R (max) =1 (R(max) 
represents non-coding)". As an example, the parity-check- 
matrix generating units 10 and 30 calculate a parity check 
matrix H R( i) having a coding ratio as close as possible to 
" 0 " . 

The parity-check-matrix generating units 10 and 30 

extract a parity check matrix H R(L) (an nxk matrix) with an 
arbitrary coding ratio R(L)=(n-k)/n from the parity check 

matrix H r( d , calculate a generator matrix G R(L) (an (n-k)xn 
matrix) that satisfies "H R(L) G R ( L ) =0 " from the parity check 
matrix H R(L) , and calculate an inverse matrix G R(L ) 1 (an 

nx (n-k) matrix) of G R < L ) (G R ( L > _1 *G R ( L )=I (a unit matrix)) 
(step SI and step Sll) . For convenience of explanation, 
the arbitrary coding ratio R(L) is set to 0.6. 

According to the present embodiment, quantum key 
distribution that uses an LDPC code having an excellent 
characteristic extremely close to the Shannon limit as the 
specific liner code is explained. Other liner codes such 
as a turbo code may be used as the specific liner code. 
For example, if error correction information (syndrome) 
described later is an error correction protocol represented 
by a product Hm A of an appropriate matrix H and 
transmission data m A (a part of information m a ) (e.g., an 
error correction protocol corresponding to the "quantum key 
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distribution capable of correcting a data error on a 
transmission path" explained in the related art) , or if 
linearity of the error correction information and the 
transmission data m A is secured, the matrix H may be used 
5 as a parity check matrix. 

A method of forming an LDPC code in the parity-check- 
matrix generating unit 10 (corresponding to the processing 
at step SI) is explained below. 

A parity check matrix for an LDPC code C R (d is set as 
10 H R( i) . The coding ratio R(l) , 1=1 , 2, . . . , max is 

"0<R ( 1 ) <R (2 ) < . . . <R (max) =1 " . R (max) represents non- coding . 

It is possible to define the parity check matrix H R( i) 
as represented by Equation (1) using a parity check matrix 
Hr(i+d and an additional parity check matrix A r( d . Fig. 4 
15 is a diagram indicating Equation (1) . 

H 



H R(D 



R(l+1) 



A R(1) 



(1) 



Both the parity check matrix H r( d and the parity check 
matrix H R(1 +u are full ranks. 

According to the present embodiment, an order 
20 allocation of the parity check matrix H r( d , 1=1 , 2, 

max is optimized by the Gaussian approximation. In other 
words, an order allocation of the parity check matrix H r( d 
that minimizes Equation (2) is calculated. 

max 

Z GAP R0) < 2 > 
1=1 

25 GAP R( i) is a dB representation of a difference between 

an SNR of an iterative threshold of the parity check matrix 
H R (i) estimated by the Gaussian approximation and a Shannon 
limit . 

As a method of calculating an order allocation of the 
30 parity check matrix H r( d that minimizes Equation (2) , for 
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example, Equation (3) is calculated. Equation (3) is a 

calculation for searching for X(x, R(l)) and p(x, R(l)) 

that maximize the Gaussian noise c n (R(l)). Constrains in 
calculating Equation (3) are as indicated by Equations (4) , 
(5) , (6) , and (7) . 



max 



I>n(R(») 

1=1 



(3) 



f p(x,R(l)) 

J = l-R(D 

J o Mx,R(0) 

X(x, R(l)) = X, (R(l)) + ?i 2 (R(l))x 1 + • 
p(x, R(l)) = Pl (R(l)) + p 2 (R(D)x 1 + • • 



. rRrly . dv(max,R(l))-l 

+ A dv(max,R(l)) (. K UJM 

. (Hn\\ x dc(max,R(l))-l 

+ Pdc(max,R(l)) <- K UA>X 



(4) 
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A.(x, R(l)) = 1 
p(x,R(l)) = l 



(5) 



r > 



dv(max,R(l)) 

E 

i=2 



r 



^i(R(l))ct> 



dc(max,R(l)) / \ 

(i-i) £ PjCRCDH-Hi-O-^" 1 ) 



s + 



V 



j=2 



J 



Vre(0,<|>(s)) 

0<Xi(R(l))<l, ^(R(l))eR 
0< Pi (R(l))<l, Pi (R(l))eR 



<|>(x) = 



(u-x)' 



1--t=L= f tanh- e 4 * du, ifx>0 



1, 



if x<0 



(6) 



A, (/?(/))< 



2 n v (*,/?(/ + 1)) xi 



£ « v (y, /?(/)) xy 



Total number of "Y's in 
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A,i(R(l)) represents a ratio of columns of an order i 



of the parity check matrix H r( d and pi(R(l)) represents a 
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ratio of rows of the order i of the parity check matrix 
H R (i) . dv(max, R(l)) represents a maximum order of columns 
of the parity check matrix H R(1) and dc(max, R(l)) 
represents a maximum order of rows of the parity check 

5 matrix H R( i) . X(x, R(l)) is a generating function of an 

order allocation of the columns of the parity check matrix 

H R (i) and p(x, R(l)) is a generating function of an order 
allocation of the rows of the parity check matrix H r( d . 
n v (i, R(l)) represents the number of columns of the order i 
10 of the parity check matrix H r( d and n c (i, R(l)) represents 
the number of rows of the order i of the parity check 
matrix H r( d . 

As an example of processing for calculating the parity 
check matrix H r( d at step SI, processing for calculating a 

15 parity check matrix H R(3) , a parity check matrix H R(2 ) , and a 
parity check matrix H r( d in order is specifically explained 
below. Fig. 5 is a flowchart of a method of forming an 
" Irregular-LDPC code" based on the Euclidian geometric code. 
Since the parity-check-matrix generating unit 30 operates 

20 in the same manner as the parity-check-matrix generating 
unit 10 , an explanation of the parity-check-matrix 
generating unit 30 is omitted. Check matrix generation 
processing according to the present embodiment may be 
executed by, for example, the parity-check-matrix 

25 generating unit 10 or other control apparatuses (a computer, 
etc.) on the outside of the communication apparatus 
according to parameters set. When the check matrix 
generation processing according to the present embodiment 
is executed on the outside of the communication apparatus, 

30 a check matrix already generated is stored in the 

communication apparatus. In the explanation of the 
embodiment below, the parity-check-matrix generating unit 
10 executes the processing. 
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First, the parity-check-matrix generating unit 10 
determines a code length and coding ratios (step S21 in Fig. 
5) . For example, the code length n is set to 5000 and the 
coding ratios R(3), R(2), and R(l) are set to 0.6, 0.4, and 
5 0.0, respectively . 

The parity-check-matrix generating unit 10 selects a 
Euclidian geometric code EG (2, 2 s ) and generates 
fundamental-matrixes A (s=5, R(3)), A(s=5, R(2)), and A(s=5, 
R(l)) forming a basis of a check matrix for the "Irregular- 

10 LDPC code" (step S22) . For example, when s is set to 5 , a 
weight distribution (column numbers of "1") in a first row 
of a Euclidian geometric code EG (2, 2 5 ) is as follows. 

{1 32 114 136 149 223 260 382 402 438 467 507 574 579 
588 622 634 637 638 676 717 728 790 851 861 879 947 954 971 

15 977 979 998} 

In coding and decoding using the LDPC code, in general, 
it is possible to obtain a more satisfactory characteristic 
when there are fewer "cycles 4" and "cycles 6" in a 
bipartite graph. Thus, according to the present embodiment, 

20 "1" is appropriately curtailed from the weight distribution 
on the first row of the Euclidian geometric code EG (2, 2 5 ) 
to control fewer number of cycles such as the "cycles 4" 
and the "cycles 6) . A weight distribution after 
curtailment is, for example, as follows. 

25 {1 32 114 136 149 223 260 402 438 467 507 574 588 634 

638 717 728 790 861 947 971 979} 

Weight distributions on first rows of the respective 
basis matrixes are determined on the basis of the weight 
distribution after curtailment (positions of "1" are 

30 allocated individually) . The weight distributions are 

cyclically shifted to generate fundamental-matrixes A (s=5, 

R(3)), A(s=5, R(2)), and A(s=5, R(l)) with 1023 rows x 1023 
columns. According to the present embodiment, weight 
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distributions on the first rows of the respective 
fundamental-matrixes are determined, for example, as 
follows . 

A(s=5, R(3))={1 32 114 149 260 402 467 507 574 634 717 
5 728 790 861 979} 

A(s=5, R(2))={223 438 947} 
A(s=5, R(l))={136 588 638 971} 

Consequently, a maximum order of columns of the parity 
check matrix H R(3 ) dv(max, R(3)) is 15, a maximum order of 

10 columns of the parity check matrix H R(2 ) dv(max, R(2)) is 3, 
and a maximum order of columns of the parity check matrix 
H R (i) dv(max, R(l))) is 4. A maximum order of rows of the 
parity check matrix HR(3) dc(max, R(3)) is 15, a maximum 
order of rows of the parity check matrix HR(2) dc(max, 

15 R(2)) is 3, and a maximum order of rows of the parity check 
matrix HR(1) dc(max, R(l)) is 4 . 

The parity-check-matrix generating unit 10 permutes 
the respective fundamental-matrixes according to a 
procedure described below to place a position of "1" as 

20 high as possible in a column (step S23) . In general,, the 
permutation procedure is represented as indicated by 
Equation (8) . 

h k (X)eGF(2)[X]/X (22s - 1} 
k = ^,2,...,2 2 .(2 2s -l)} 



h i+ i(X) 



h i+2 (X) 



X 


-(wl- 


-1) 


X 


-(w2- 


-1) 


X 


-(w3- 


-1) 



(wl-1) +x (w2-l) 



.■IK™] 



(8) 
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In Equation (8), i is set as l-2 2s -l . A polynomial 



(X 1 " 1 i '+X lw ' c + is an Equation representing first rows of 



(Wl-l) + y (W2-1) 

the respective fundamental-matrixes. For example, when 
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positions of a weight of a basic row is {1 7 9 ... 40} , a 

first row of the fundamental-matrix is 1+X (7_1) + . . . X (40 ~ 

i) 

In Equation (8) , when there are i and j that make 
5 hi(X) equal to hj (x) when i is 1 to 2 2s -l and j is 1 to i-1, 
hi (X) is deleted. According to the permutation,, when 
processing for deleting (processing for reducing) rows 
described later is performed, it is possible to keep 
columns with as large weights as possible and reduce 
10 variations of weights in columns as much as possible. 

As a specific example, for example', when a Euclidian 
geometric code EG (2, 2 2 ) is set as a fundamental-matrix, a 
matrix shown in Fig. 6 is permuted like a matrix shown in 
Fig. 7 by carrying out the permutation procedure described 
15 above. Fig. 6 is a diagram of a matrix of the Euclidian 

geometric code EG (2, 2 2 ) (blanks represent 0) . Fig. 7 is 
a diagram of a matrix after permutation. 

The parity-check-matrix generating unit 10 executes 
processing for calculating a parity check matrix H R ( 3) with 

20 2000 rows x 5000 columns (optimization calculation) using 
the code length n=5000, the coding ratio R(3)=0.6, and the 
fundamental-matrix A (s=5, R(3)) after permutation 
determined above (step S24) . 

First, the parity-check-matrix generating unit 10 

25 searches for generating functions Mx, R(3)) and p(x, R(3)) 

that maximize Gaussian noise a n (R(3)) . In this case, 
Equations (4), (5) , and (6) are constraints. Fig. 8 is a 
table of an order allocation after the optimization 
calculation . 

30 The parity-check-matrix generating unit 10 calculates 

a reduced matrix based on the fundamental-matrix A(s=5, 
R(3)), the key length [translator's comment: "key length" 



20 



should be corrected to "code length"] n=5000, and the 
coding ratio R(3)=0.6. For example, when jaeZ (a positive 
integer) is the number of a row of an order i divided from 
one row of the basis matrix A(s, R(l) ) , the number of 
divisions of a row is represented by Equation (9) . 

dc(m ax,R (l) ) 
i=l 

dc(m ax ,R ( 1) ) 

Number of divisions of a row = ^ p ± (9) 

In the explanation in Fig. 8, 7ja7/15 + 8|a 8 /15=l ((a 7 =l, 

jj, 8 =1) Thus, the number of divisions of a row is "1 + 1=2". 

The number of rows of the reduced matrix is 
represented by Equation (10) . 

Number of rows of the reduced matrix=nx (1-R (3) ) /number 

of divisions of a row=5000x (1-0 . 6) /2=1000 (10) 
This means that the parity-check-matrix generating 

unit 10 deletes twenty-three rows from the bottom of the 

basic row A(s=5, R(3)) with 1023 rows to generate a reduced 

matrix A'(s=5, R(3)) with 1000 rows. 

Thereafter, the parity-check-matrix generating unit 10 

calculates, with an order ratio pi(R(3)) of a row and an 
order i of the row shown in Fig. 8 fixed, the number of 
columns n v (i, R(3)) of orders i=2 , 3, and 4 of the parity 
check matrix H R(3 ) and the number of rows n c (i, R(3)) of 
orders i=7 and 8 of the parity check matrix H R(3 ) that can 
be formed using the reduced matrix A' (s=5 , R(3)). An order 

ratio A,j.(R(3)) of rows is adjusted to set the number of 
columns of a matrix after division to 5000. Fig. 9 is a 
table of order allocation after adjustment. 

Thereafter, the parity-check-matrix generating unit 10 
divides rows and columns of the reduced matrix A'(s=5, 
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R(3)) based on the order allocation shown in Fig. 9 and 
sets a result of the division as a parity check matrix 

Hro) ' with 2000 rows x 5000 columns. Moreover, the parity- 
check-matrix generating unit 10 permutes the columns to 
5 arrange weights of the columns of the parity check matrix 
H R( 3) ' after division in an ascending order and sets a 
matrix after permutation as a parity check matrix H R ( 3) . 
Fig. 10 is a diagram of the parity check matrix Hr (3 ) . 
There are 1000 rows with a weight "7", 1000 rows with a 

10 weight "8", 279 columns with a weight "2", 4442 columns 
with a weight "3", and 279 columns with a weight "4". 

The division processing for a reduced matrix according 
to the present embodiment (including division processing 
described later) is performed by extracting "1" from the 

15 respective rows and the respective columns at random 

(random division) rather than regularly dividing the matrix. 
Any method may be used for this extraction processing as 
long as the randomness is maintained. 

The parity-check-matrix generating unit 10 executes 

20 processing for calculating a parity check matrix H R(2 ) and 
an additional matrix A R(2 ) in Equation (11) (optimization 
calculation) using the code length n=5000, the coding ratio 
R(2)=0.4, and the fundamental-matrix A(s=5, R(2)) after 
permutation determined above (step S25) . Only processing 

25 different from the processing for calculating the parity 

■ 

check matrix H R(3) is explained. 

H R(2) = 

The parity-check-matrix generating unit 10 searches 

for generating functions Mx, R(2)) and p(x, R(2)) that 

30 maximize Gaussian noise a n (R(2)). In this maximization 
calculation, Equation (7) is a constraint in addition to 



H 



R(3) 



R(2) 



(11) 
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Equations (4) , (5) , and (6) . Specifically, it is a 



10 



constraint that Equation (12) generated based on Equation 



(7) is satisfied. 



f 



K (/?(/-!))< 



\ 



£ H y (i, /?(/)) XI 

V*=2 
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Total number of "Y's in H 



(12) 



*(/-!) 



Therefore, for example, constraints of an order 2, an 
order 3, and an order 4 in the parity check matrix H R <2) are 
Equation (13) , Equation (14) , and Equation (15) , 
respectively . 



A., < 



n v (2, R(l))x2 

1000x15 + 1000x3 
279x2 



18000 
= 0.031 



(13) 



n v (3, R(l)) x 3 + n v (2, R(l)) x 2 - n v (2, R(l - 1)) x 2 

1000x15 + 1000x3 
4686x3 + 279x2-n v (2, R(l-l))x2 



= 0.812- 



6x5000x0.6 
n v (2,R(l-l)) 

9000 



(14) 



< n v (4, R(l)) x 4 + n v (3, R(l)) x 3 + n v (2, R(l))x 2 - (n v (3, RQ - 1)) x 3 + n v (2, R(l -1)) x 2) 

" 4 ~ 1000<15+100a<3 
_ 96x4+4686<3+279x 2 -(n v (3, R(l -l))x3 +n v (2,R(l-l))x2) 



=0.833- 



18000 

(n v (3, R(l -l))x3+n v (2, R(l -l))x2) 



18000 

(15) 

15 Moreover, it is also a constraint that a maximum order 

of columns of the parity check, matrix H R( 2) satisfies 
Equation (16) . 

Maximum order of columns of H R( 2) =maximum order of 
columns of H R(3) +number of elements of A(s=5, R(2)) (16) 



Fig. 11 is a table of order allocation obtained as a 
result of the optimization calculation. 

On the other hand, the parity-check-matrix generating 
unit 10 calculates a reduced matrix A'(s=5, R(2)) according 
to the same processing as Equation (9) and Equation (10) 
using the number of elements of the fundamental-matrix 
A(s=5, R(2)), the code length n=5000, and the coding ratio 
R(2)=0.4. 

In the example in Fig. 11, 3jj,3/18 + 7|j,7/18 + 8|j,8/18 = 1 (jj,3=1, 

1^7=1 , and ^8=1) - Thus, the number of division of a row is 
"1+1+1=3". 

The parity-check-matrix generating unit 10 deletes 
twenty-three rows from the bottom of the basic row A(s=5, 

r 

R(2)) with 1023 rows to generate a reduced matrix A'(s=5, 
R(2)) with 1000 rows. 

Thereafter, the parity-check-matrix generating unit 10 
divides columns of the reduced matrix A'(s=5, R(2)) based 
on the order allocation shown in Fig. 11 and sets a result 
of the division as a provisional additional matrix A R(2 ) ' 

with 1000 rows x 5000 columns. Moreover, the parity-check- 
matrix generating unit 10 permutes the columns to arrange 
weights of the columns of the provisional additional matrix 
A R(2 ) ' after division in an ascending order and sets a 
matrix after permutation as a formal additional matrix A R(2 ) 
Fig. 12 is a diagram of the additional matrix A R(2) . There 
are 1000 rows with a weight "3", 150 rows with a weight "1" 
6 columns with a weight "2", and 946 columns with a weight 
"3". Fig. 13 is a diagram of a parity check matrix H R(2) - 
Finally, the parity-check-matrix generating unit 10 
executes processing for calculating a parity check matrix 
H R (i) and an additional matrix A Ra) in Equation (17) 
(optimization calculation) using the code length n=5000, 
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the coding ratio R(2)=0.0 / the fundamental-matrix A(s=5, 
R(l)) , and the parity check matrix H R(2 ) determined above 
(step S26) . This processing is performed in the same 
procedure as the processing for calculating the parity 
5 check matrix H R(2 ) . 

H R(i) = 

Thereafter, the parity-check-matrix generating unit 10 
divides rows and columns of a reduced matrix A'(s=5, R(l)) 
based on an order allocation obtained as a result of the 
10 calculation and sets a result of the division as a 

provisional additional matrix A R(1) ' with 2000 rows x 5000 
columns-. Moreover, the parity-check-matrix generating unit 
10 permutes the columns to arrange weights of the columns 
of the provisional additional matrix A R( u ' after division 
15 in an ascending order and sets a matrix after permutation 
as a formal additional matrix A R( u . Fig. 14 is a diagram 
of a specific example of the additional matrix A r( d . Fig. 
15 is a diagram of a specific example of the parity check 
matrix H R( u . 

20 In this way, according to the present embodiment, it 

is possible to generate the check matrixes H R(3) , H R(2 ) , and 
H R (d for the * Irregular-LDPC code", which are definite and 
have stable characteristics, by executing steps S21 to S26. 
According to the present embodiment, the Euclidian 

25 geometric code is used as a code forming a basis (a 

fundamental-matrix). However, the present invention is not 
limited to this. Matrixes other than the Euclidian 
geometric code (a fundamental-matrix according to a Cayley 
graph, a fundamental-matrix according to a Ramanujan graph, 

30 etc.) may be used as long as the matrixes satisfy a 

condition that weights of rows and columns are fixed and 



H 



R(2) 



R(l) 



(17) 
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the number of cycles on a bipartite graph is equal to or 
more than six. 

According to the present embodiment , the parity check 
matrix H R( u with a coding ratio as close as possible to *0" 
5 is finally generated. However, the present invention is 
not limited to this. Parity check matrixes with sizes 
(H R(2 ) , H R( 3) , H R( 4) , etc.) may be generated in advance as 
required according to a communication environment. 
According to the present embodiment, the parity check 
10 matrixes in three stages are assumed. However, parity 
check matrixes may be formed in any number of stages as 
long as a satisfactory characteristic is obtained. 

After the parity check matrix H r( d and generator 
matrixes G R ( L ) and G _1 R ( L ) are generated as described above, 
15 in the communication apparatus on the transmission side, a 
random-number generating unit 11 generates a random number 
sequence m a (a sequence of 1 and 0: transmission data) and 
determines transmission codes (+: a code corresponding to a 
measuring device capable of identifying light deflected in 

20 the horizontal and vertical directions, x: a code 

corresponding to a measuring device capable of identifying 
light polarized in an oblique direction) at random (step S2 
in Fig. 2) . On the other hand, in the device on the 
reception side, a random-number generating unit 31 

25 determines reception codes (+: a code corresponding to the 
measuring device capable of identifying light polarized in 

the horizontal and vertical directions, x: a code 
corresponding to the measuring device capable of 
identifying light polarized in an oblique direction) at 
30 random (step S12 in Fig. 3) . 

Subsequently, in the communication apparatus on the 
transmission side, a photon generating unit 12 transmits a 
photon in a polarizing direction automatically determined 
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according to a combination of the random number sequence m a 
and the transmission codes (step S3) . For example, the 
photon generating unit 12 transmits light polarized in the 
horizontal direction according to a combination of 0 and +, 
5 light polarized in the vertical direction according to a 

combination of 1 and +, light polarized in the 45° 

direction according to a combination of 0 and x, and light 

polarized in the 135° direction according to a combination 

of 1 and x to a quantum communication path, respectively 

10 (transmission signals) . 

A photon receiving unit 32 of the communication 
apparatus on the reception side, which has received light 
signals of the photon generating unit 12, measures light on 
the photon communication path (reception signals) . The 

15 photon receiving unit 32 obtains reception data m b 

automatically determined according to a combination of a 
reception code and a reception signal (step S13) . The 
photon receiving unit 32 obtains, as the reception data m b , 
0, 1, 0, and 0 according to a combination of the light 

20 polarized in the horizontal direction and +, a combination 
of the light polarized in the vertical direction and + , a 

combination of the light polarized in the 45° direction and 

x, and a combination of the light polarized in the 135° 

direction and x, respectively. The reception data m b is 

i 

25 assumed to be a hard decision' value with probability 
information . 

In the communication apparatus on the reception side, 
to check whether the measurement is performed by a correct 
measuring device, the random-number generating unit 31 
30 transmits a reception code to the communication apparatus 
on the transmission side via a public communication path 
(step S13) . The communication apparatus on the 
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transmission side, which has received the reception code, 
checks whether the measurement is performed by a correct 
measuring device and transmits a result of the check to the 
communication apparatus on the reception side via the 
5 public communication path (step S3) . The communication 
apparatus on the reception side and the communication 
apparatus on the transmission side keep only data 
corresponding to a reception signal received by the correct 
measuring device and discard the other data (steps S3 and 

10 S13) . Thereafter, the communication apparatus on the 
reception side and the communication apparatus on the 
transmission side store the data kept in memories or the 
like, read out n bits in order from the top of the data, 
and set the n bits of data as formal transmission data m A 

15 and formal reception data m B (m B is m A affected by noise and 
the like on the transmission path: m B =m A +e (noise and the 
like)) . In other words, the communication apparatus on the 
reception side and the communication apparatus on the 
transmission side read out the next n bits as required and 

20 generate the transmission data m A and the reception data m B . 
According to the present embodiment, the communication 
apparatus on the reception side and the communication 
apparatus on the transmission side can share bit positions 
of the data kept. Like the reception data m b , the 

25 reception data m B is a hard decision value with probability 
information . 

In the communication apparatus on the transmission 
side, a syndrome generating unit 14 calculates a syndrome 

S A =H R(L) m A of m A using the parity check matrix H R(L ) (an nxk 
30 matrix) and the transmission data m A and notifies the 

communication apparatus on the reception side of a result 
of the calculation via a public-communication-path 
communication unit 13 and the public communication path 
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(step S4) . At this stage, it is likely that the syndrome 
S A of m A is learnt by a wiretapper. Fig. 16 is a diagram 
of the syndrome S A that the communication apparatus on the 
transmission side transmits to the communication apparatus 
on the reception side. On the other hand, in the 
communication apparatus on the reception side, a public- 
communication-path communication unit 34 receives the 
syndrome S A of m A and notifies a syndrome decoding unit 33 
of the syndrome S A (step S14) . 

The syndrome decoding unit 33 estimates the original 
transmission data m A by correcting an error of the hard 
decision value m B with probability information due to noise 
or the like using the known syndrome decoding method (step 
S15) . According to the present embodiment, for example, 
the syndrome decoding unit 33 estimates m c satisfying 
"S A =H R ( L )m c " from the hard decision value m B with probability 
information and sets a result of the estimation as shared 
information m A . According to the present embodiment, the 
reception data m B and m b are hard decision values with 
probability information. However, the present invention is 
not limited to this. For example, the present invention is 
also applicable when the reception data m B and m b are soft 
decision values. It is not specifically defined what kind 
of reception data is used. 

When the error of the hard decision value m B is 
completely corrected by processing at step S15 ("OK" at 
step S15) , in the communication apparatus on the reception 
side, a common-key generating unit 35 discards a part of 
the shared information m A according to error correction 
information laid open to the public (information for the k 
bits that is likely to have been wiretapped: S A ) and 
generates an encryption key r including an amount of 
information for n-k bits (step S16) . In other words, the 
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common-key generating unit 35 generates the encryption key 

r according to Equation (18) using Gr(l)" 1 (an nx (n-k) 
matrix) calculated earlier. The communication apparatus on 
the reception side uses the encryption key r as a common 
5 key to be shared with the communication apparatus on the 
transmission side . 

r=G R(L) ~ 1 m A (18) 
In the communication apparatus on the transmission 
side, when the error of the hard decision value m B is 

10 completely corrected by the processing at step S15 and a 

new syndrome request is not received ("Yes" at step S5) , a 
common-key generating unit 15 discards a part of the shared 
information m A according to the error correction 
information laid open to the public (the information for k 

15 bits that is likely to have been wiretapped: S A ) and 
generates an encryption key r including an amount of 
information for n-k bits (step S6) . In other words, the 
common-key generating unit 15 generates the encryption key 

r according to Equation (18) using Gr^) -1 (an nx (n-k) 
20 matrix) calculated earlier (step S6). The communication 

apparatus on the transmission side uses the encryption key 

r as a common key to be shared with the communication 

apparatus on the reception side. 

Moreover, according to the present embodiment, the 
25 common key may be permuted using a regular random matrix R. 

This makes it possible to reinforce confidentiality. 

Specifically, first, the communication apparatus on the 

transmission side generates the regular random matrix R (an 

(n-k) x (n-k) matrix) and notifies the communication 
30 apparatus on the reception side of the regular random 
matrix R via the public communication path. This 
processing may be performed in the communication apparatus 
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on the reception side. Thereafter, the communication 
apparatuses on the transmission side and the reception side 
generate the encryption keys r according to Equation (19) 

using Gr(l) _1 (an nx (n-k) matrix) calculated earlier. 
5 r=RG R(L) - 1 m A (19) 

On the other hand, when the error of the hard decision 
value m B is not completely corrected by the processing at 
step S15 ("NG" at step S15) , the syndrome decoding unit 33 
of the communication apparatus on the reception side 
10 notifies the communication, apparatus on the transmission 
side of a syndrome request via the public-communication- 
path communication unit 34 and the public communication 
path (step S17). The parity-check-matrix generating unit 

30 extracts a parity check matrix H R(L -i) (an nx(k+t) matrix) 
15 with a coding ratio R (L-l ) = (n-k-t ) /n from the parity check 
matrix H r( d (lowers the coding ratio) , generates a 

j 

generator matrix G R ( L -d .satisfying "H r(l -d G R(L _i) =0 " from the 
parity check matrix H R ( L _u , and further generates an inverse 
matrix G R(L -i ) " 1 of G R(L -i) (G R (l-i)" 1 *G r(l -i ) =I (a unit matrix) ) 

20 (step S18) . 

Fig. 17 is a diagram for explaining how the parity 
check matrix H r(l _d is extracted from the parity check 
matrix H r( d . According to the present embodiment, as shown 
in the figure, a parity check matrix at the time of 

25 transmission of an additional syndrome is generated by 

slicing a parity check matrix with a size corresponding to 
a coding ratio from the parity check matrix H r( d generated 
in advance. In other words, it is possible to easily 
generate a parity check matrix with a size corresponding to 

30 a coding ratio without executing optimization calculation 
corresponding to the coding ratio (the Gaussian 
approximation) every time. 

A lowering range of a coding ratio depends on required 
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conditions of a system. For example, when the lowering 
range of a coding ratio is set small, although it is likely 
that the number of times of error correction processing is 
increased, a key generation ratio is improved. When the 
5 lowering range of a coding ratio is set large, although it 
is possible to reduce the number of times of error 
correction processing, a key generation ratio falls. 

Similarly, the parity-check-matrix generating unit 10 
of the communication apparatus on the transmission side, 
10 which has received the syndrome request ("No" at step S5) , 

extracts a parity check matrix H R(L _i) (an nx(k+t) matrix) 
with a coding ratio R (L-l ) = (n-k-t ) /n from the parity check 
matrix H r( d , generates a generator matrix G R ( L -d satisfying 
"Hr (l _i)Gr(l-i)=0" from the parity check matrix H R(L _i) , and 
15 further generates an inverse matrix G R ( L -i) _1 of G R ( L -d (G R < L - 
i)~ 1 *G R ( L _i) =1 (a unit matrix)) (step S7) . 

In the communication apparatus on the transmission 
side, the syndrome generating unit 14 calculates a syndrome 
S A ' for t rows using the parity check matrix H R (L-i) (an 

20 nx (k+t) matrix) and the transmission data m A and notifies 
the communication apparatus on the reception side of a 
result of the calculation via the public-communication-path 
communication unit 13 and the public communication path 
(step S8) . Fig. 18 is a diagram of a method of generating 

25 an additional syndrome. At this stage, it is likely that 
the syndrome S A ' (information for t bits) is learnt by a 
wiretapper. In the communication apparatus on the 
reception side, the public-communication-path communication 
unit 34 receives the syndrome S A ' for t rows and notifies 

30 the syndrome decoding unit 33 of the syndrome S A ' (step 
S19) . 

The syndrome decoding unit 33 corrects an error of the 
hard decision value m B with probability information and 
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estimates the original transmission data m A again using the 
known syndrome decoding method (step S15) . 

Thereafter, in the communication apparatus on the 
reception side according to the present embodiment, a 
5 desired parity check matrix is extracted from the parity 
check matrix H R( i) to repeatedly execute the processing at 
steps S17 to S19 while a coding ratio is lowered until the 
error of the hard decision value m B is completely corrected 
by the processing at step S15. When the error is 

10 completely corrected, the common-key generating unit 35 

discards a part of the shared information m A according to 
error correction information laid open to the public (e.g., 
the information for k+t bits that is likely to have been 
wiretapped: S A +S A ' (see Fig. 18)). The common-key 

15 generating unit 35 generates, for example, an encryption 

key r including an amount of information for n-k-t, n-k-2t, 
n-k-3t, . . . bits (step S16)-. The communication apparatus 
on the reception side uses the encryption key r as a common 
key to be shared with the communication apparatus on the 

20 transmission side. 

In the communication apparatus on the transmission 
side according to the present embodiment, a desired parity 
check matrix is extracted from the parity check matrix H r( d 
to repeatedly execute the processing at steps S7 and S8 

25 while a coding ratio is lowered until a new syndrome 

request is not notified any more. When a new syndrome 
request is not notified any more, the common-key generating 
unit 15 discards a part of the shared information m A 
according to error correction information laid open to the 

30 public (e.g., the information for k+t bits that is likely 
to have been wiretapped: S A +S A ' (see Fig. 7) ) . The common- 
key generating unit 15 generates, for example, an 
encryption key r including an amount of information for n- 
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k-t, n-k-2t, n-k-3t, . . . bits (step S6) . The communication 
apparatus on the transmission side uses the encryption key 
r as a common key to be shared with the communication 
apparatus on the reception side. 
5 As described above, according to the present 

embodiment, an error of reception data is corrected using 
check matrixes for the "Irregular-LDPC code", which are 
definite and have stable characteristics, and a part of 
shared information is discarded according to error 

10 correction information laid open to the public. 

Consequently, parities are not exchanged the enormous 
number of times to specify and correct an error bit. Error 
correction control is performed by simply transmitting 
error correction information. Thus, it is possible to 

15 substantially reduce time required for error correction 
processing. Since a part of shared information is 
discarded according to information laid open to the public, 
it is possible to generate a common key security of which 
is highly guaranteed. 

20 According to the present embodiment, a desired parity 

check matrix is extracted from the parity check matrix H R( i) 
while a coding ratio is lowered until an error of reception 
data is completely corrected, an additional syndrome is 
further generated, and error correction processing is 

25 repeatedly executed using the additional syndrome. Since 
this makes it unnecessary to discard shared information 
generated to estimate a noise level of a communication path, 
it is possible to substantially improve efficiency of 
generating a common key. 

30 

INDUSTRIAL APPLICABILITY 

As described above, the quantum key distribution 
method and the communication apparatus according to the 
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present invention are useful as a technology for generating 
a common key, security of which is highly guaranteed. In 
particular, the quantum key distribution method and the 
communication apparatus are suitable for communication on a 
5 transmission path on which a wiretapper is likely to be 
present . 



